Is Prime Connect - Message Sender safe?
Prime Connect - Message Sender sends WhatsApp phone-number and location analytics to Google Analytics.
When WhatsApp Web loads, the content script builds analytics labels from the stored WhatsApp number plus plan type and plan duration, then sends them with city, region, country, and dial code to Google Analytics. The location fields are populated by a GeoJS IP geolocation request on install, and the analytics payload includes a persistent client ID from Chrome storage.
Who publishes itescuderohuillcamasccoevaristo - 3 other listings from the same operator, 1 of them carrying a finding
escuderohuillcamasccoevaristo - 3 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
3 other listings published from this account, 12k+ users between them. 1 of them carries a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Prime Connect links your WhatsApp number and location to Google Analytics
Prime Connect reads your WhatsApp account number from WhatsApp Web's own storage and sends it, joined with your plan details and location, to Google Analytics on every visit.
Confirmed with a planted test number.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open WhatsApp Web with Prime Connect installed.
The content script reads your WhatsApp account number from the page's own storage and sends it, with your city and country, to Google Analytics.
- Tracking label51987654321 Premium 30d (illustrative)
Combines your WhatsApp number with your subscription plan and its duration into one identifier.
- City / region / countryLima, Lima, Peru
Approximate location resolved from your IP address when the extension was installed.
- Dial code+51
Country calling code paired with the resolved location.
- Client ID550e8400-e29b-41d4-a716-446655440000
A random ID stored by the extension that ties every event to the same install over time.
Reading the number and building the tracked event
getTrackLabel / getTrackLocation / trackSystemEvent
contentmin.js// Builds the label sent with every analytics event: the user's WhatsApp// number joined with their plan type and plan duration.function getTrackLabel() { try { return [myWhatsAppNumber, planType, planDuration].join(" ").trim(); } catch { return ""; }}// Adds the install-time geolocation (from get.geojs.io) to the event,// unless it's still the un-resolved default.function getTrackLocation() { return locationInfo.default ? {} : { city: locationInfo.city, region: locationInfo.region, country: locationInfo.country, dial_code: locationInfo.dialCode, };}// Fired on every WhatsApp Web page load (see "whatsapp_visit" in init()).function trackSystemEvent(eventName, track = "") { trackGenericEvent(eventName, { type: "event", track });}// Merges the phone-number label, location, and app context into one// Google Analytics event and hands it to GoogleAnalytics.trackEvent().function trackGenericEvent(eventName, extraParams) { const label = getTrackLabel(); const params = { ...getTrackLocation(), ...getTrackContext(), ...extraParams, }; GoogleAnalytics.trackEvent(eventName, { label, ...params });}fireEvent sends the payload to Google Analytics
codegoogle.jsasync function fireEvent(eventName, params = {}) { // Attach a session id and a default engagement time to every event. params.session_id ||= await this.getOrCreateSessionId(); params.engagement_time_msec ||= GA_CONFIG.DEFAULT_ENGAGEMENT_TIME_MSEC; // POST straight to Google's Measurement Protocol collector, with a // persistent per-install client_id read from chrome.storage.local. const endpoint = this.debug ? GA_CONFIG.GA_DEBUG_ENDPOINT : GA_CONFIG.GA_ENDPOINT; await fetch( `${endpoint}?measurement_id=${GA_CONFIG.MEASUREMENT_ID}&api_secret=${GA_CONFIG.API_SECRET}`, { method: "POST", body: JSON.stringify({ client_id: await this.getOrCreateClientId(), events: [{ name: eventName, params }], }), } );}HTTP 204 No Content (standard Measurement Protocol response).
{ "client_id": "550e8400-e29b-41d4-a716-446655440000", "events": [ { "name": "whatsapp_visit", "params": { "label": "51987654321 Premium 30d", "city": "Lima", "region": "Lima", "country": "Peru", "dial_code": "+51", "init_store_type": "md", "whatsapp_version": "2.3000.1", "extension_version": "3.1.108", "engagement_time_msec": 100 } } ]}- www.google-analytics.com
Receives the WhatsApp number label, plan details, and location fields via the Measurement Protocol; operated by Google.
- get.geojs.io
Resolves the extension's install-time IP address to a city, region, and country used in later analytics events.
Where it sends data
Destinations our analysis observed Prime Connect - Message Sender contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google-analytics.comwidely used
Prime Connect - Message Sender sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.
- get.geojs.io
Prime Connect - Message Sender sends data to get.geojs.io. 4 other extensions we have analysed send data here.